Executive Summary
| Summary | |
|---|---|
| Title | Cisco TelePresence System Software Command Execution Vulnerability |
| Informations | |||
|---|---|---|---|
| Name | cisco-sa-20140122-cts | First vendor Publication | 2014-01-22 |
| Vendor | Cisco | Last vendor Modification | 2014-01-22 |
| Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 8.3 | Attack Range | Adjacent network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 6.5 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Cisco TelePresence System Software contains a vulnerability in the System Status Collection Daemon (SSCD) code that could allow an unauthenticated, adjacent attacker to execute arbitrary commands with the privileges of the root user. Cisco has released free software updates that address this vulnerability. No workarounds that mitigate this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-cts BEGIN PGP SIGNATURE Version: GnuPG/MacGPG2 v2.0.20 (Darwin) iF4EAREKAAYFAlLftvIACgkQUddfH3/BbTrePQD9FSpmHbt1k2llXblHoEoQrOEd 1G5+AeNJnwMANjUfiSsA/RtJM/0hpPgxhq/FekwVXg4FLeNCpfB+UJqEjAhezWzy =RUj5 END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
| Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
CPE : Common Platform Enumeration
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2014-01-30 | IAVM : 2014-A-0016 - Cisco TelePresence System Remote Code Execution Vulnerability Severity : Category II - VMSKEY : V0043847 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-01-28 | Name : The remote device may be affected by a command execution vulnerability. File : cisco-sa-20140122-cts.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 10:22:13 |
|
| 2014-01-31 21:20:33 |
|
| 2014-01-23 21:24:58 |
|
| 2014-01-22 21:19:22 |
|
